CVE-2023-40982

MediumCVSS 5.4

Published: 15/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.

Risk Assessment

The risk involves arbitrary script execution in the administrator's browser, potentially leading to session theft, account takeover, or further system compromise.

Recommendation

Immediately upgrade Webmin to a version newer than 2.100 and implement input filtering for the module name parameter.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.